You are here: News > News > Online Viral Outbreak Costs Google Ad Profits
| » IT Security NEWS |
| |
| » 31 May 2009 |
| Online Viral Outbreak Costs Google Ad Profits |
According to security researcher Mary Landesman, users should beware of a hack that's been redirecting a lot of unwitting Google users clicking on their search results to compromised sites that will pump your computer full of malware and turn it into a botnet that perpetuates the hack's spread.
Using the real-time malware scanning services of ScanSafe, Landesman has uncovered that the amount of websites corrupted by the malware attack has almost tripled during the past two weeks or so compared to the number of attacks last March. Typically, web compromises like the Google hack naturally expire after just a few weeks because anti-virus programs and search engines quickly adapt to their presence. However, different circumstances are currently at play here.
During the early part of this year, ScanSafe STAT has been observing and detecting the exponentially increasing amount of botnets that's been sending malware from the IP address 94.247.2.195. The malware delivered by the hacks forces Google's search results to redirect its links to other similarly corrupted sites.
This harmful, botnet-making software also consists of a component that steals FTP account information like passwords and usernames. As more and more users are being manipulated by the malicious program through forcible search redirects or visits to compromised sites, hackers are able to gather an ever-growing amount of corrupted web pages, thus garnering a larger number of victims.
Landesman confessed that the growth rate of the Google web compromise is quite strange and alarming, adding that "the fact that it's escalating so quickly is what has us (here at ScanSafe) concerned."
Because JavaScript obfuscation is the latest weapon hackers have against detection by both Google searches and security tools, the exploit code for this compromise also has the same concealment abilities. Every exploit code is distinct to the website it has infected, which makes them hopelessly hard to spot until you've actually surfed into the compromised website.
The compromise hides its JavaScript code deep into a site's source code in order to take advantage of the bugs in a web surfer's Adobe Reader and Flash applications. Once the breach is finished, your computer will become part of a botnet that makes all your Google search results redirect to infected sites that worsens your PCs already compromised condition.
Draining off the profits from Google's incredibly lucrative advertising franchises seems to be the main objective of the viral malware's existence. By inserting advertisements and links into selected queries, compromised computer systems tend to get results that are far from what they should be. In any case, users should exercise extra care in dealing with this particularly versatile and resourceful security threat.
|
|